Threat Detection

Review audit logs, access policies and request history from the OmniRoute CLI

Evolve a security detection harness against a vulnerability corpus and grade it

Automate AbuseIPDB tasks with the Rube MCP toolkit from Composio

Automate Fraudlabs Pro tasks with the Rube MCP toolkit from Composio

Automate Ip2proxy tasks with the Rube MCP toolkit from Composio

Automate Ip2whois tasks with the Rube MCP toolkit from Composio

Automate Ipdata co tasks with the Rube MCP toolkit from Composio

Look up domain, DNS and IP history with SecurityTrails through Composio Rube MCP

Monitor SSL certificate issuance with SSLMate Cert Spotter through Composio Rube MCP

Reconstruct TCP and UDP sessions and decode protocols from packet captures

Review email security with SPF, DKIM and DMARC checks and phishing analysis

Hunt threats with Sigma and YARA rules and validate SIEM detections

Enrich IOCs and threat actor leads from public OSINT sources with corroboration

Hunt BOLA, IDOR and injection attacks in API gateway access logs with pandas

Map APT group techniques onto MITRE ATT&CK Navigator layers to find detection gaps

Hunt Azure threats in activity and sign-in logs with KQL, including impossible travel

Weigh cyber campaign evidence with Diamond Model and ACH to attribute threat actors

Monitor Certificate Transparency logs for phishing and lookalike domain certificates

Parse Malleable C2 profiles and generate network detection signatures for Cobalt Strike

Detect DNS tunneling, DGA domains and covert C2 in DNS query logs

Score IOCs for maliciousness, attribution and blocking priority from alerts and feeds

Hunt intrusions and privilege escalation in Linux auditd logs with ausearch

Scan suspicious URLs with urlscan.io for screenshots, DOM content and network traffic

Look up malware family aliases, YARA rules and lineage in the Malpedia API

Detect covert C2 and exfiltration channels in DNS, ICMP and HTTP traffic

Spot port scans, beaconing and exfiltration in NetFlow v9 and IPFIX records

Dissect pcap files and craft packets with Scapy to spot malformed traffic

Capture and dissect network traffic with Wireshark and tshark to spot malicious patterns

Hunt Office 365 account compromise via forwarding rules, delegation and OAuth grants

Spot PowerShell Empire traces in script block and module logs

Decode obfuscated PowerShell from script block logs in EVTX files

Collect and trend victim postings from ransomware leak sites for risk reports

Spot ransomware C2 beaconing and Tor exits in Zeek conn logs and NetFlow

Investigate incidents with Splunk SPL across Windows, firewall, proxy and auth logs

Map threat actor behavior to MITRE ATT&CK and find detection coverage gaps

Compare APT group techniques against defenses with ATT&CK Navigator layer files

Normalize threat intel feeds into STIX 2.1 and extract actionable indicators

Summarize MISP events, IOC types and actor clusters into threat landscape reports

Find phishing domains and typosquats in Certificate Transparency logs with crt.sh

Generate lookalike domain permutations with dnstwist to catch brand impersonation

Detect SQL injection, traversal and brute force in Apache and Nginx access logs

Detect Windows authentication attacks, persistence and lateral movement in Splunk

Monitor Certificate Transparency logs to catch rogue certificates for your domains

Enrich raw IOCs with multi-source threat intel in SOAR or Python to cut triage time

Build a Python tracker that maps threat actor C2 networks through DNS, certs and WHOIS

Turn CTI reports into a searchable STIX 2.1 library of ATT&CK-mapped attack patterns

Set up Microsoft Sentinel SIEM with multi-cloud connectors, KQL detections and playbooks

Write Splunk SPL correlation searches that detect threats in SOC environments

Write vendor-neutral Sigma rules and convert them to Splunk, Elastic or Sentinel